| Index: trunk/phase3/includes/DefaultSettings.php |
| — | — | @@ -4142,21 +4142,30 @@ |
| 4143 | 4143 | * Newer browsers support cross-site AJAX when the target resource allows requests |
| 4144 | 4144 | * from the origin domain by the Access-Control-Allow-Origin header. |
| 4145 | 4145 | * This is currently only used by the API (requests to api.php) |
| 4146 | | - * $wgCrossSiteAJAXdomains can be set as follows: |
| | 4146 | + * $wgCrossSiteAJAXdomains can be set using a wildcard syntax: |
| 4147 | 4147 | * |
| 4148 | | - * - the string '*' to allow requests from any domain |
| 4149 | | - * - an array of domains to allow AJAX requests from, e.g. |
| 4150 | | - * array( 'http://en.wikipedia.org', 'http://en.wikibooks.org' ); |
| 4151 | | - * - if $wgCrossSiteAJAXdomainsRegex is true, an array of regexes to be |
| 4152 | | - * matched against the request origin. Anything that matches will be allowed |
| | 4148 | + * '*' matches any number of characters |
| | 4149 | + * '?' matches any 1 character |
| | 4150 | + * |
| | 4151 | + * Example: |
| | 4152 | + $wgCrossSiteAJAXdomains = array( |
| | 4153 | + 'www.mediawiki.org', |
| | 4154 | + '*.wikipedia.org', |
| | 4155 | + '*.wikimedia.org', |
| | 4156 | + '*.wiktionary.org', |
| | 4157 | + ); |
| | 4158 | + * |
| 4153 | 4159 | */ |
| 4154 | 4160 | $wgCrossSiteAJAXdomains = array(); |
| 4155 | 4161 | |
| 4156 | 4162 | /** |
| 4157 | | - * Set to true to treat $wgCrossSiteAJAXdomains as regexes instead of strings |
| | 4163 | + * Domains that should not be allowed to make AJAX requests, |
| | 4164 | + * even if they match one of the domains allowed by $wgCrossSiteAJAXdomains |
| | 4165 | + * Uses the same syntax as $wgCrossSiteAJAXdomains |
| 4158 | 4166 | */ |
| 4159 | | -$wgCrossSiteAJAXdomainsRegex = false; |
| 4160 | 4167 | |
| | 4168 | +$wgCrossSiteAJAXdomainExceptions = array(); |
| | 4169 | + |
| 4161 | 4170 | /** |
| 4162 | 4171 | * The minimum amount of memory that MediaWiki "needs"; MediaWiki will try to raise PHP's memory limit if it's below this amount. |
| 4163 | 4172 | */ |
| Index: trunk/phase3/api.php |
| — | — | @@ -64,21 +64,37 @@ |
| 65 | 65 | } |
| 66 | 66 | |
| 67 | 67 | // Selectively allow cross-site AJAX |
| 68 | | -if ( $wgCrossSiteAJAXdomains && isset($_SERVER['HTTP_ORIGIN']) ) { |
| 69 | | - if ( $wgCrossSiteAJAXdomains == '*' ) { |
| 70 | | - header( "Access-Control-Allow-Origin: {$_SERVER['HTTP_ORIGIN']}" ); |
| 71 | | - header( 'Access-Control-Allow-Credentials: true' ); |
| 72 | | - } elseif ( $wgCrossSiteAJAXdomainsRegex ) { |
| 73 | | - foreach ( $wgCrossSiteAJAXdomains as $regex ) { |
| 74 | | - if ( preg_match( $regex, $_SERVER['HTTP_ORIGIN'] ) ) { |
| 75 | | - header( "Access-Control-Allow-Origin: {$_SERVER['HTTP_ORIGIN']}" ); |
| 76 | | - header( 'Access-Control-Allow-Credentials: true' ); |
| 77 | | - break; |
| | 68 | + |
| | 69 | +/* |
| | 70 | + * Helper function to convert wildcard string into a regex |
| | 71 | + * '*' => '.*?' |
| | 72 | + * '?' => '.' |
| | 73 | + * @ return string |
| | 74 | + */ |
| | 75 | +function convertWildcard( $search ) { |
| | 76 | + $search = preg_quote( $search, '/' ); |
| | 77 | + $search = str_replace( |
| | 78 | + array( '\*', '\?' ), |
| | 79 | + array( '.*?', '.' ), |
| | 80 | + $search |
| | 81 | + ); |
| | 82 | + return "/$search/"; |
| | 83 | +} |
| | 84 | + |
| | 85 | +if ( $wgCrossSiteAJAXdomains && isset($_SERVER['HTTP_ORIGIN']) ) { |
| | 86 | + $exceptions = array_map( 'convertWildcard', $wgCrossSiteAJAXdomainExceptions ); |
| | 87 | + $regexes = array_map( 'convertWildcard', $wgCrossSiteAJAXdomains ); |
| | 88 | + foreach ( $regexes as $regex ) { |
| | 89 | + if ( preg_match( $regex, $_SERVER['HTTP_ORIGIN'] ) ) { |
| | 90 | + foreach ( $exceptions as $exc ) { // Check against exceptions |
| | 91 | + if ( preg_match( $exc, $_SERVER['HTTP_ORIGIN'] ) ) { |
| | 92 | + break 2; |
| | 93 | + } |
| 78 | 94 | } |
| | 95 | + header( "Access-Control-Allow-Origin: {$_SERVER['HTTP_ORIGIN']}" ); |
| | 96 | + header( 'Access-Control-Allow-Credentials: true' ); |
| | 97 | + break; |
| 79 | 98 | } |
| 80 | | - } elseif ( in_array( $_SERVER['HTTP_ORIGIN'], $wgCrossSiteAJAXdomains ) ) { |
| 81 | | - header( "Access-Control-Allow-Origin: {$_SERVER['HTTP_ORIGIN']}" ); |
| 82 | | - header( 'Access-Control-Allow-Credentials: true' ); |
| 83 | 99 | } |
| 84 | 100 | } |
| 85 | 101 | |
| Index: trunk/phase3/RELEASE-NOTES |
| — | — | @@ -75,7 +75,7 @@ |
| 76 | 76 | PHP and database version. |
| 77 | 77 | * $wgSecondaryGoNamespaces allows an arry of namespaces to be checked when the |
| 78 | 78 | GO button is pressed, in addition to the main namespace. |
| 79 | | -* (bug 19907) $wgCrossSiteAJAXdomains and $wgCrossSiteAJAXdomainsRegex added |
| | 79 | +* (bug 19907) $wgCrossSiteAJAXdomains and $wgCrossSiteAJAXdomainExceptions added |
| 80 | 80 | to control which external domains may access the API via cross-site AJAX. |
| 81 | 81 | * $wgMaintenanceScripts for extensions to add their scripts to the default list |
| 82 | 82 | * $wgMemoryLimit has been added, default value '50M' |